Topic starter
12/06/2026 9:26 pm
TL;DR: The governance issue is not speed alone but avoiding authorization drift when policy decisions are scattered across functions, according to Cerbos. Cerbos now supports running its PDP inside AWS Lambda as either a standalone function or an extension layer, with Cerbos Hub managing policy and audit logs centrally for consistent authorization across serverless, container, and VM workloads.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Run Cerbos natively inside AWS Lambda”.
Key questions
Q: How should teams prevent authorization drift across serverless functions?
A: Treat policy as a shared control surface, not per-function code.
Q: Why does embedding access logic in each Lambda create governance risk?
A: Because each handler can evolve its own interpretation of access, even when the business intent is the same.
Q: What signs show that serverless authorization is becoming inconsistent?
A: Watch for different access outcomes across similar functions, policy fixes that require multiple redeployments, and audit logs that cannot tie a decision back to one current rule set.
Practitioner guidance
- Centralise authorization policy outside Lambda handlers Move access decisions into a shared policy layer so each function calls for a decision instead of owning its own rules.
- Choose the Lambda deployment pattern by enforcement need Use a standalone function when many Lambdas need the same decision service, and use the extension layer when latency inside the function matters most.
- Standardise policy bundles across all runtimes Ensure the same policy version is distributed to containers, VMs, and serverless workloads so authorisation outcomes do not diverge by platform.
Bottom line: Serverless authorization breaks down when policy decisions are scattered across functions instead of being governed centrally.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:30 pm
Serverless authorization drift is the real governance problem, not Lambda performance alone. When teams scatter access logic across handlers, they lose a single place to test, review, and attest policy. That is especially damaging in multi-tenant and hybrid environments, where small logic differences become inconsistent access outcomes. The practical conclusion is that serverless authorization must be governed as a policy lifecycle, not as scattered code.
A question worth separating out:
Q: Should teams use an embedded Lambda extension or a standalone policy function?
A: Use the embedded extension when low latency and local enforcement are the priority. Use the standalone function when many workloads need the same policy service and centralised control matters more than local execution speed. The choice should follow the governance model and performance profile, not habit.
👉 Read our full editorial: Cerbos in AWS Lambda changes serverless authorization governance